Specify a maximal depth of backtracking for the pattern attribute on input elements

[vinhill]

WebKit and Blink enforce a maximal depth of backtracking of 1,000,000 (see here for WebKit, here for Blink) when checking an input's value against a regular expression specified in #the-pattern-attribute. Gecko is discussing this in Bug 1837772. Without such a limit, a pattern like (\d+)* can hang a tab.

Such a backtracking limit could be included in the spec around the pattern attribute and it might be worth to discuss whether this limit should also be applied in other situations. There is already this wpt testing this behavior.

[annevk]

This is a limit that appears to be implemented in the regular expression engine. It doesn't seem specific to input elements. As such this would be TC39 territory I think. And if it's not defined there the test is probably invalid.

cc @mathiasbynens @syg

[vinhill]

For Blink, the limit does not apply to JavaScript code, i.e. /(\d+)*$/.exec("0000011111111111111000z"). It does though apply in WebKit.

Only Blinks ScriptRegexp constructor applies the backtracking limit and seems to be used only for C++-side regexes.

[mathiasbynens]

@schuay @pthier, given that, do we really need to apply kBacktrackLimit for ScriptRegexp?

[schuay]

Yes IMO this still makes sense - for Blink's ScriptRegexp, the reasoning is described at crbug.com/966405 and https://bugs.chromium.org/p/chromium/issues/detail?id=89872#c26.

[annevk]

@Constellation do you think it would make sense to have the limit on regular expressions only for <input pattern>? (WebKit currently has it on regular expressions in general.) So you'd only prevent against a loop when there's no JavaScript involved.

[msaboff]

I think it makes sense for RegExp engines to put a cap on recursion for both Scripts and HTML. Otherwise, as we can see, it is easy to create a webpage that hangs.

[annevk]

Thanks! I filed tc39/ecma262#3166 so TC39 can figure out how they want to approach this. Unless they define a limit inline, we'll need some kind of host hook if we are to enforce a limit.